| blob | 41de104dea71399cdce122ac39c4e70e0a7a40b0 |
1 .\" Copyright (c) 2008 Canonical Ltd. All rights reserved.
2 .\"
3 .\" Redistribution and use in source and binary forms, with or without
4 .\" modification, are permitted provided that the following conditions
5 .\" are met:
6 .\" 1. Redistributions of source code must retain the above copyright
7 .\" notice, this list of conditions and the following disclaimer.
8 .\" 2. Redistributions in binary form must reproduce the above copyright
9 .\" notice, this list of conditions and the following disclaimer in the
10 .\" documentation and/or other materials provided with the distribution.
11 .\"
12 .\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
13 .\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
14 .\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
15 .\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
16 .\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
17 .\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
18 .\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
19 .\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
20 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
21 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
22 .\"
23 .Dd $Mdocdate: May 12 2008 $
24 .Dt SSH-VULNKEY 1
25 .Os
26 .Sh NAME
27 .Nm ssh-vulnkey
28 .Nd check blacklist of compromised keys
29 .Sh SYNOPSIS
30 .Nm
31 .Op Fl q
32 .Ar file ...
33 .Nm
34 .Fl a
35 .Sh DESCRIPTION
36 .Nm
37 checks a key against a blacklist of compromised keys.
38 .Pp
39 A substantial number of keys are known to have been generated using a broken
40 version of OpenSSL distributed by Debian which failed to seed its random
41 number generator correctly.
42 Keys generated using these OpenSSL versions should be assumed to be
43 compromised.
44 This tool may be useful in checking for such keys.
45 .Pp
46 Keys that are compromised cannot be repaired; replacements must be generated
47 using
48 .Xr ssh-keygen 1 .
49 Make sure to update
50 .Pa authorized_keys
51 files on all systems where compromised keys were permitted to authenticate.
52 .Pp
53 The argument list will be interpreted as a list of paths to public key files
54 or
55 .Pa authorized_keys
56 files.
57 If no suitable file is found at a given path,
58 .Nm
59 will append
60 .Pa .pub
61 and retry, in case it was given a private key file.
62 If no files are given as arguments,
63 .Nm
64 will check
65 .Pa ~/.ssh/id_rsa ,
66 .Pa ~/.ssh/id_dsa ,
67 .Pa ~/.ssh/identity ,
68 .Pa ~/.ssh/authorized_keys
69 and
70 .Pa ~/.ssh/authorized_keys2 ,
71 as well as the system's host keys if readable.
72 .Pp
73 If
74 .Dq -
75 is given as an argument,
76 .Nm
77 will read from standard input.
78 This can be used to process output from
79 .Xr ssh-keyscan 1 ,
80 for example:
81 .Pp
82 .Dl $ ssh-keyscan -t rsa remote.example.org | ssh-vulnkey -
83 .Pp
84 .Nm
85 will exit zero if any of the given keys were in the compromised list,
86 otherwise non-zero.
87 .Pp
88 Unless the
89 .Cm PermitBlacklistedKeys
90 option is used,
91 .Xr sshd 8
92 will reject attempts to authenticate with keys in the compromised list.
93 .Pp
94 The options are as follows:
95 .Bl -tag -width Ds
96 .It Fl a
97 Check keys of all users on the system.
98 You will typically need to run
99 .Nm
100 as root to use this option.
101 For each user,
102 .Nm
103 will check
104 .Pa ~/.ssh/id_rsa ,
105 .Pa ~/.ssh/id_dsa ,
106 .Pa ~/.ssh/identity ,
107 .Pa ~/.ssh/authorized_keys
108 and
109 .Pa ~/.ssh/authorized_keys2 .
110 It will also check the system's host keys.
111 .It Fl q
112 Quiet mode.
113 Normally,
114 .Nm
115 outputs the fingerprint of each key scanned, with a description of its
116 status.
117 This option suppresses that output.
118 .El
119 .Sh BLACKLIST FILE FORMAT
120 The blacklist file may start with comments, on lines starting with
121 .Dq # .
122 After these initial comments, it must follow a strict format:
123 .Pp
124 .Bl -bullet -offset indent -compact
125 .It
126 All the lines must be exactly the same length (20 characters followed by a
127 newline) and must be in sorted order.
128 .It
129 Each line must consist of the lower-case hexadecimal MD5 key fingerprint,
130 without colons, and with the first 12 characters removed (that is, the least
131 significant 80 bits of the fingerprint).
132 .El
133 .Pp
134 The key fingerprint may be generated using
135 .Xr ssh-keygen 1 :
136 .Pp
137 .Dl $ ssh-keygen -l -f /path/to/key
138 .Pp
139 This strict format is necessary to allow the blacklist file to be checked
140 quickly, using a binary-search algorithm.
141 .Sh FILES
142 .Bl -tag -width Ds
143 .It Pa ~/.ssh/id_rsa
144 If present, contains the protocol version 2 RSA authentication identity of
145 the user.
146 .It Pa ~/.ssh/id_dsa
147 If present, contains the protocol version 2 DSA authentication identity of
148 the user.
149 .It Pa ~/.ssh/identity
150 If present, contains the protocol version 1 RSA authentication identity of
151 the user.
152 .It Pa ~/.ssh/authorized_keys
153 If present, lists the public keys (RSA/DSA) that can be used for logging in
154 as this user.
155 .It Pa ~/.ssh/authorized_keys2
156 Obsolete name for
157 .Pa ~/.ssh/authorized_keys .
158 This file may still be present on some old systems, but should not be
159 created if it is missing.
160 .It Pa /etc/ssh/ssh_host_rsa_key
161 If present, contains the protocol version 2 RSA identity of the system.
162 .It Pa /etc/ssh/ssh_host_dsa_key
163 If present, contains the protocol version 2 DSA identity of the system.
164 .It Pa /etc/ssh/ssh_host_key
165 If present, contains the protocol version 1 RSA identity of the system.
166 .It Pa /etc/ssh/blacklist. Ns Ar TYPE Ns Pa - Ns Ar LENGTH
167 If present, lists the blacklisted keys of type
168 .Ar TYPE
169 .Pf ( Dq RSA1 ,
170 .Dq RSA ,
171 or
172 .Dq DSA )
173 and bit length
174 .Ar LENGTH .
175 The format of this file is described above.
176 .El
177 .Sh SEE ALSO
178 .Xr ssh-keygen 1 ,
179 .Xr sshd 8
180 .Sh AUTHORS
181 .An -nosplit
182 .An Colin Watson Aq cjwatson@ubuntu.com
183 .Pp
184 Florian Weimer suggested the option to check keys of all users, and the idea
185 of processing
186 .Xr ssh-keyscan 1
187 output.